@ai-sdk/provider-utils 4.0.56 → 4.0.57

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ai-sdk/provider-utils",
-  "version": "4.0.56",
+  "version": "4.0.57",
   "license": "Apache-2.0",
   "sideEffects": false,
   "main": "./dist/index.js",

package/src/fetch-with-validated-redirects.ts

@@ -1,11 +1,70 @@
 import { cancelResponseBody } from './cancel-response-body';
 import { DownloadError } from './download-error';
+import type { FetchFunction } from './fetch-function';
 import { isBrowserRuntime } from './is-browser-runtime';
+import { isSameOrigin } from './is-same-origin';
 import { getDefaultDownloadFetch } from './safe-node-fetch';
 import { validateDownloadUrl } from './validate-download-url';
 
 const MAX_DOWNLOAD_REDIRECTS = 10;
 
+async function getValidatedFetch(
+  customFetch: FetchFunction | undefined,
+): Promise<FetchFunction> {
+  // Callers commonly pass globalThis.fetch through several abstraction
+  // layers. Preserve the DNS-pinned Node.js default in that case rather than
+  // accidentally treating it as an intentionally custom fetch.
+  return customFetch == null || customFetch === globalThis.fetch
+    ? await getDefaultDownloadFetch()
+    : customFetch;
+}
+
+/**
+ * Fetches one validated URL without following redirects.
+ *
+ * On Node.js, the default fetch validates and pins DNS results at connect time.
+ * An injected fetch is responsible for equivalent connect-time validation.
+ * Redirects are rejected by default. Callers using `redirect: 'manual'` must
+ * validate the Location target before issuing another request.
+ */
+export async function fetchWithValidatedEndpoint({
+  url,
+  init,
+  fetch: customFetch,
+  trustedOrigin,
+  redirect = 'error',
+}: {
+  url: string | URL;
+  init?: RequestInit;
+  fetch?: FetchFunction;
+  /**
+   * A developer-configured origin that may legitimately resolve to a private
+   * address. This must never be derived from untrusted response data.
+   */
+  trustedOrigin?: string;
+  redirect?: 'error' | 'manual';
+}): Promise<Response> {
+  const urlText = url.toString();
+  const isTrusted =
+    trustedOrigin !== undefined && isSameOrigin(urlText, trustedOrigin);
+
+  if (!isTrusted) {
+    validateDownloadUrl(urlText);
+  }
+
+  const fetch =
+    isTrusted && customFetch != null
+      ? customFetch
+      : isTrusted
+        ? globalThis.fetch
+        : await getValidatedFetch(customFetch);
+
+  return await fetch(url, {
+    ...init,
+    redirect,
+  });
+}
+
 /**
  * Fetches a URL while enforcing the SSRF download guard on every hop.
  *
@@ -23,6 +82,13 @@ const MAX_DOWNLOAD_REDIRECTS = 10;
  * runtime we cannot validate the hop, so we fail closed rather than follow it
  * blindly and bypass the SSRF guard.
  *
+ * A hop that is same-origin with `trustedOrigin` (the developer-configured
+ * endpoint) skips target validation: that origin is exactly what an
+ * unvalidated, config-derived request would fetch anyway, and validating it
+ * would break legitimate self-hosted / localhost deployments whose response
+ * URLs point back at the configured host. Hops on any other origin are always
+ * validated.
+ *
  * The returned response is the final (non-redirect) response. The caller is
  * responsible for checking `response.ok` and reading the body.
  *
@@ -39,11 +105,19 @@ export async function fetchWithValidatedRedirects({
   headers,
   abortSignal,
   maxRedirects = MAX_DOWNLOAD_REDIRECTS,
+  fetch: customFetch,
+  trustedOrigin,
 }: {
   url: string;
   headers?: HeadersInit;
   abortSignal?: AbortSignal;
   maxRedirects?: number;
+  fetch?: FetchFunction;
+  /**
+   * A developer-configured origin whose hops skip target validation. Must
+   * never be derived from response data.
+   */
+  trustedOrigin?: string;
 }): Promise<Response> {
   // Per-hop request options. Only the `redirect` mode varies between hops, so
   // the rest is assembled once. `headers` is omitted entirely when not provided
@@ -56,9 +130,22 @@ export async function fetchWithValidatedRedirects({
   let currentUrl = url;
   // The bound also acts as a backstop against an unterminated redirect chain.
   for (let redirectCount = 0; redirectCount <= maxRedirects; redirectCount++) {
-    validateDownloadUrl(currentUrl);
+    // The developer-configured origin is trusted by definition; validating it
+    // would reject legitimate self-hosted / localhost deployments.
+    const isTrustedHop =
+      trustedOrigin !== undefined && isSameOrigin(currentUrl, trustedOrigin);
+
+    if (!isTrustedHop) {
+      validateDownloadUrl(currentUrl);
+    }
+
+    const fetch =
+      isTrustedHop && customFetch != null
+        ? customFetch
+        : isTrustedHop
+          ? globalThis.fetch
+          : await getValidatedFetch(customFetch);
 
-    const fetch = await getDefaultDownloadFetch();
     const response = await fetch(currentUrl, {
       ...baseInit,
       redirect: 'manual',
@@ -74,7 +161,7 @@ export async function fetchWithValidatedRedirects({
       return await fetch(currentUrl, { ...baseInit, redirect: 'follow' });
     }
 
-    const location = response.headers.get('location');
+    const location = response.headers?.get('location');
     if (response.status >= 300 && response.status < 400 && location) {
       // Release the redirect response's connection before moving to the next
       // hop. Whether that hop is followed or rejected by the SSRF guard, an

package/src/index.ts

@@ -20,7 +20,10 @@ export {
   readResponseWithSizeLimit,
   DEFAULT_MAX_DOWNLOAD_SIZE,
 } from './read-response-with-size-limit';
-export { fetchWithValidatedRedirects } from './fetch-with-validated-redirects';
+export {
+  fetchWithValidatedEndpoint,
+  fetchWithValidatedRedirects,
+} from './fetch-with-validated-redirects';
 export * from './fetch-function';
 export { createIdGenerator, generateId, type IdGenerator } from './generate-id';
 export * from './get-error-message';

package/src/safe-node-fetch.ts

@@ -102,57 +102,52 @@ export function createSafeLookup(lookup: Lookup): SafeLookup {
 }
 
 let safeNodeFetchPromise: Promise<FetchFunction> | undefined;
-const initialGlobalFetch = globalThis.fetch;
-const initialGlobalFetchIsNodeDefault = isNodeDefaultFetch(initialGlobalFetch);
 
 export function isNodeRuntime(): boolean {
   const runtimeProcess = globalThis.process as
     | {
         release?: { name?: string };
-        versions?: { bun?: string };
+        title?: string;
+        versions?: { bun?: string; deno?: string };
       }
     | undefined;
 
+  // Node-compatible process objects do not imply support for Node DNS/socket
+  // hooks. Workers identifies itself as workerd, including without navigator.
   return (
     runtimeProcess?.release?.name === 'node' &&
-    runtimeProcess.versions?.bun == null
+    runtimeProcess.versions?.bun == null &&
+    runtimeProcess.versions?.deno == null &&
+    runtimeProcess.title !== 'workerd' &&
+    (globalThis as { EdgeRuntime?: unknown }).EdgeRuntime == null
   );
 }
 
 export async function getDefaultDownloadFetch(): Promise<FetchFunction> {
-  if (
-    !isNodeRuntime() ||
-    !initialGlobalFetchIsNodeDefault ||
-    globalThis.fetch !== initialGlobalFetch
-  ) {
+  if (!isNodeRuntime()) {
     return globalThis.fetch;
   }
 
+  // Global fetch wrappers cannot be relied on to preserve the dispatcher
+  // that pins connections to validated DNS results.
   return (safeNodeFetchPromise ??= createSafeNodeFetch());
 }
 
-function isNodeDefaultFetch(fetch: unknown): boolean {
-  if (typeof fetch !== 'function') {
-    return false;
-  }
-
-  const source = Function.prototype.toString.call(fetch);
-  return (
-    source.includes('internal/deps/undici') ||
-    source.includes('lazy loading of undici')
-  );
-}
-
 async function createSafeNodeFetch(): Promise<FetchFunction> {
   // Load Node-only modules indirectly so browser bundlers do not pull undici
   // and Node built-ins into the browser-facing provider-utils entry point.
-  const [{ createRequire }, { lookup }] = await Promise.all([
+  // @vercel/nft (node file trace) only recognizes an indirectly loaded createRequire when its receiver
+  // is named `module` and the returned require function is assigned.
+  // eslint-disable-next-line @next/next/no-assign-module-variable
+  const [module, { lookup }] = await Promise.all([
     loadNodeModule<NodeModule>('node:module'),
     loadNodeModule<NodeDns>('node:dns'),
   ]);
-  const { Agent, fetch } = createRequire(getCurrentModulePath())(
-    'undici',
-  ) as Undici;
+
+  // Assign the created require function so deployment tracers can recognize
+  // the static dependency without bundlers inlining undici.
+  const nodeRequire = module.createRequire(getCurrentModulePath());
+  const { Agent, fetch } = nodeRequire('undici') as Undici;
 
   const dispatcher = new Agent({
     connect: {